[Polichinel]

Closes the first ask of #501. Measurement only — nothing is optimised.

The problem

The 2026-10-16 run measured the zarr export at 18,427s (5h07m): 88% of the pipeline, and ~5× ADR-041's June figure of ~57 min. The regression could be stated but not located, because the export printed one Time: line and nothing else.

What this adds

Four phases, printed in the export's summary and written to export_ledger.jsonl as phase_seconds:

Phase	Covers
scan	the source_sums loop — one traversal of grid.npy per feature
write	ds.to_zarr + consolidate_metadata — the second traversal, plus compression
verify	the round-trip integrity check — full decompression of the written store
swap	the C-144 .tmp → rename dance
other	the remainder, printed explicitly so the columns account for the whole of Time:

I added swap beyond the three #501 asked for because measuring it is free and it lets us rule it out instead of assuming it's cheap.

On the synthetic grid (7 features, 0.1 GB, fits in RAM):

Time: 1.9s
Phases:
  scan          0.2s   10.1%
  write         0.7s   35.2%
  verify        0.5s   24.7%
  swap          0.0s    0.0%
  other         0.6s   30.0%

The ledger is the point, not the print. logs/refresh.log rotates. phase_seconds in the ledger makes the breakdown queryable across runs, which is what turns one measurement into a trend — and the absence of exactly that is why a 5× regression sat unnoticed for four months.

Two claims verified rather than inferred

The comments in the diff assert things about the data layout. I measured them:

Claim	Evidence
grid.npy is C-order with features as the contiguous last axis	C_CONTIGUOUS=True, strides=(..., 28, 4) at F=7 → grid[:,:,:,i] strides F × 4 bytes between adjacent (t,h,w), i.e. 316 bytes at F=79. A 4 KB page carries ~13 useful float32s out of 1024.
source_sums exists only to feed the verify comparison	exactly one consumer, export_zarr.py:408

The second matters: the scan phase reads the entire grid purely to produce checksums for a later comparison.

Explicitly not done

No change to chunking, compression, the slicing pattern, or the integrity check. Each is a plausible remedy for a cause that is not established, and the integrity check is an ADR-011/C-144 guarantee that must not be weakened to buy time.

#501 carries a pre-registered falsification criterion written before any production measurement exists:

if scan comes in under ~25% of the export, the strided-memmap explanation is refuted and I stop advancing it

The hypothesis is mine, so pre-committing the criterion is the only thing stopping me from reading the result as confirmation. The synthetic baseline above — where scan is the smallest named phase — is the contrast.

Guards, drilled

Three tests in TestZarrExport. The phase labels are asserted as an exact set: a subset assertion would let a dropped phase silently restore the original blindness. Both substantive guards were sabotaged to confirm they bite:

Sabotage	Result
delete phase_seconds["swap"] = ...	test_phase_timings_recorded FAILED
inflate the scan timer past the total	test_phases_do_not_exceed_the_total FAILED — phases sum to 9999.8s but total is 1.3s

Register: no new entry, and why

Nothing in the register covers runtime regression, and check_health.py has freshness SLOs (how old the data is) but no duration SLO. That gap is real.

It is not a new entry, for two reasons. The instrument that would have caught this is what this PR builds — registering a concern this PR largely closes would be noise. And the root cause is already recorded: the 5× went unnoticed because ADR-041's figures were the only record and nobody re-measured, which is C-343's pattern exactly, registered as its 2026-10-18 addendum in #500.

What remains genuinely open: durations are now recorded but nothing compares them across runs. One run of data does not yet justify a trend-watching mechanism, so I am flagging it rather than building it.

Verification

• full suite — exit 0, 0 FAILED, 0 ERROR (not 137; that would be OOM, not green)
• uv run ruff check . — clean
• uv run mypy src/ — clean, 89 source files
• bash docs/validate_docs.sh — PASSED
• export-touching test files re-run green against the final tree, since the full suite above predates a variable rename

Pre-existing and out of scope: export_zarr.py:100 has a mypy union-attr error on sys.stdout.reconfigure, identical on a clean tree. CI typechecks src/ only, so it does not gate — but it is real and unowned.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EfeuULbPTqrx4qtNki5dy9